Cyber War Talks Heat Up at UN With Russia at Table

United Nations diplomats who are meeting this week to set ground rules and guidelines for how states interact in cyber space had choice words for Russia, the country that willed the working group into existence.

“Russia has made a mockery of its pretension to lead on cyberissues at the United Nations,” Michele Markoff, U.S. lead on cyber matters at the meeting. She said Russia had attacked Ukrainian banks, government websites and private sector entities as part of its invasion in a way “designed to affect the civilian population.” 

Canada’s representative, Dan McBryde, said it was “surreal” that Russia was undermining the very guidelines on state use of cyber tools that Moscow had helped birth, while the U.K.’s Kathryn Jones listed previous cyberattacks by Russia on Ukraine.

The meeting was for a UN entity known as the open-ended working group for security and the use of information and communications technologies. Its task has always always been a challenge: corralling the world’s countries to ward off the accelerating threat of global cyber war.

But this week it’s happening in the midst of Russia’s bloody invasion of Ukraine, when both sides are lobbing digital attacks at one another, and the U.S. is warning about retaliatory hacks from Russia. 

To complicate matters further, Russia led the creation of the working group and pushed the UN to create standards in cyber space. 

“All of these accusations are completely unfounded,” said Vladimir Shin, Russia’s representative at the meeting, alleging the U.S. and “cyber mercenaries” were instead launching cyberattacks against Russia. He claimed he spoke for “the silent majority” in opposing what he said was a group of Western states trying to block the format and work of the meeting.

This week’s meeting marks the latest in the often tortured evolution of global cyber diplomacy, underscoring long-dueling efforts from the U.S. and Russia for competing visions of cyber space amid the growing threat of digital warfare.

A senior State Department official argued Russia wanted more rules in cyber space to embed authoritarian principles. The official told Bloomberg U.S. instructions were to thwart Russian objectives at the group this week, and to fight Russia’s vision of cyber space “tooth and nail” throughout the five-year forum.

The U.S. on Monday successfully pushed for the rest of the week’s meetings to take place solely on an “informal” basis, a move that will dilute the work of the group and was opposed by Russia and some others.

Despite the animus at the start of the meeting, some stakeholders remain hopeful that the group could make some progress. Among them is the CyberPeace Institute, a Geneva-based body focused on reducing harmful cyberattacks, which is pressing for the working group to take action to limit healthcare hacks and spyware.

A UN diplomat said diplomatic processes were especially needed in “moments of high tension.” “You need that red telephone to be working precisely when thing are hot, not when things are good,” said the diplomat. 

Russia pushed for rules in cyber space at a smaller UN forum known as a “group of governmental experts” starting in 2004. The U.S. gave this effort short shrift until a 2007 cyberattack against a series of Estonian organizations including the parliament, banks and broadcasters – which Estonian authorities blamed on Moscow – served as a wake-up call to the risks of state-sponsored hacking, according to the senior U.S. state department official.

The U.S. then started participating in 2009 with “an approach that was at kind of 90 degrees” from Russia’s, the official added. The U.S. argued existing international law should govern state use of cyber tools.

The UN General Assembly endorsed 11 voluntary peacetime norms — voluntary measures — for responsible state behavior in cyber space in 2015. Three of these ruled out malicious state activities online, such as attacks on critical infrastructure such as healthcare systems. Other norms encouraged international cooperation in cyber space and for countries to report vulnerabilities.  

When talks later snagged, Russia in 2019 initiated a parallel UN forum — the open-ended working group — with broader membership. That forum won out; the group of governmental experts — the forum created in 2004 — no longer meets.  

Prior to the Ukraine war, there was signs of progress. The working group reached a surprise consensus last year and accepted the 11 norms of state behavior in cyber space originally agreed to in 2015. It watered down references to human rights, but gave activists hope that future discussions might see states start to embrace the guidelines.

But lately, progress has slowed. Amid growing diplomatic polarization over Russia, the group’s work has bogged down in procedural disagreements about the inclusion of civil society and private sector groups and other bureaucratic discussions.

Jürg Lauber, the Swiss ambassador who was chairman of the first open-ended working group from 2019 to 2021, noted a negative trend in malicious activity since, saying “the number and severity of violations of said framework by states and others seem to go up rather than down.” He told Bloomberg that the failure by states to address issues like attribution and accountability in cyberattacks “may end up weakening the normative framework, as norms that are repeatedly violated with impunity carry little respect.”

A European diplomat said any new laws would more strictly bind law-abiding states, but that Russia was already breaking existing guidelines. The diplomat added that judging by Russia’s current behavior it was unlikely to adhere to them.

In what may have been an omen for what was to come, the group’s chairman Burhan Gafoor, Singapore’s ambassador to the UN, was interrupted near the start of the meeting by the digital voice assistant Siri, saying, “I’m sorry. I didn’t get that.”

“I seem to have no control over my Apple watch,” he said.

But Gafoor was managing his expectations for the week. He told participants that he sees this week’s meeting in itself as a “confidence-building measure.”